Who was sanctioned, and for what?

At the instruction of a group company based in Switzerland, the seed company had telematics devices installed in company cars that also recorded private journeys and assigned employees scores for their driving behaviour. Italy's data protection authority (Garante per la protezione dei dati personali) found breaches of transparency, purpose limitation, data minimisation and employee protection rules, imposed 120,000 EUR and ordered the deletion of the data on private journeys.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 5 Abs. 1 lit. a-c, 6 Abs. 1 lit. f, 13, 28, 88; Codice privacy Art. 2-quaterdecies, 113, 114

Action

Fine

Status of proceedings

final

Sector

Food and agriculture

Mitigating circumstances

Small number of data subjects (five employees), immediate suspension of the processing.

Checked against the official source on 25 Sep 2026 · Direct link

Starbucks Corporation had suppliers in Korea audited under its Ethical Sourcing Program by Elevate Hong Kong Holdings Limited, did not conclude a processing contract containing all statutory terms and did not supervise the provider adequately; Elevate processed unnecessarily large amounts of data on supplier employees, such as personnel files, wage and working-time records, and transferred them out of the businesses. The authority ordered Starbucks to award such work only under a written contract with all mandatory terms and to train and supervise the provider, and recommended data minimisation; a separate order was issued against Elevate.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data processors

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 26(1) und (4)

Action

Order

Status of proceedings

unknown

Sector

Food and agriculture

Employees

10,000 or more

Published

27 Nov 2025

Checked against the official source on 4 Oct 2026 · Direct link

Data of employees of McDonald’s and its franchisees from the rota module (including names, PESEL or passport numbers, working hours, positions) sat in a publicly accessible directory. UODO found that McDonald’s Polska had carried out no risk analysis, implemented no appropriate safeguards and not effectively supervised its processor, and imposed fines of PLN 1,632,063, 13,600,528 and 1,700,066 (PLN 16,932,657 in total) and a reprimand; the processor 24/7 Communication received PLN 94,286, 42,429 and 47,143 (PLN 183,858), making PLN 17,116,515 overall. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c und f, Art. 5 Abs. 2, Art. 25 Abs. 1, Art. 28 Abs. 1, Art. 32 Abs. 1 und 2, Art. 38 Abs. 1 DSGVO sowie Art. 34 Abs. 1 und 3 lit. c DSGVO (Verwarnung) (Verantwortlicher); Art. 28 Abs. 3 lit. c, Abs. 4 und 9, Art. 32 Abs. 1 und 2, Art. 38 Abs. 1 DSGVO (Auftragsverarbeiter)

Action

Fine

Status of proceedings

under appeal

Sector

Food and agriculture

Published

21 Jul 2025

Original amount 17,116,515 PLN, converted at the ECB reference rate of 23 Jun 2025.

Checked against the official source on 28 Sep 2026 · Direct link

An employee of the catering company lost a USB stick containing unencrypted data on a colleague, including PESEL number, passport data and salary. The risk analysis had not provided for the mere loss of data carriers, encryption was left to employees with only an instruction video, and the effectiveness of the measures was not tested; the President of the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, UODO) imposed 238,345 PLN (not final).

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 5 Abs. 2, Art. 24 Abs. 1, Art. 25 Abs. 1, Art. 32 Abs. 1 und 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Mitigating circumstances

Self-reporting of the incident and cooperation in the proceedings substantially reduced the fine.

Published

17 May 2024

Original amount 238,345 PLN, converted at the ECB reference rate of 29 Apr 2024.

Checked against the official source on 28 Sep 2026 · Version 5 · Company name anonymised since 29 Apr 2026 · Direct link

Persónuvernd (Icelandic Data Protection Authority) fined the operator of a fast-food restaurant chain in Iceland 1,500,000 ISK because the manager of one outlet had used footage from the surveillance cameras to check an employee's work and had produced annotated screenshots for that purpose. The authority found this to be unlawful processing outside the declared purpose of the surveillance and also criticised signs that did not name the controller and inadequate information for employees; it ordered the company to delete the screenshots, put up compliant signs in its outlets, inform employees and keep a record of processing activities.

Authority / court

Persónuvernd

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 Bst. a–c, Art. 6 Abs. 1, Art. 12 und 13 DSGVO; §§ 8, 9, 14 Abs. 1 und 4 und 17 Gesetz Nr. 90/2018 (isländisches Datenschutzgesetz); Regeln Nr. 837/2006 über elektronische Überwachung; Geldbuße nach § 46 Abs. 3 Gesetz Nr. 90/2018 i.V.m. Art. 83 Abs. 5 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Culpability

negligent

Mitigating circumstances

Only one outlet and relatively few people affected, no proven direct damage, only one documented instance of performance monitoring.

Liability of senior managers

The monitoring was carried out by the manager of one outlet; the authority stated that companies must instruct employees who have access to footage. The fine was imposed on the operating company.

Published

20 Mar 2024

Original amount 1,500,000 ISK, converted at the ECB reference rate of 12 Mar 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 12 Mar 2026 · Direct link

A restaurant company with a delivery and pick-up service (name pseudonymised) recorded workstations in the kitchen and pick-up area without interruption, even outside opening hours, and stored the recordings for 14 days. In addition, there had been no record of processing activities since 2018; the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 20,000 EUR, and the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 30 Abs. 1 DSGVO

Action

Fine

Status of proceedings

final

Sector

Food and agriculture

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

The operator of two establishments in Andalusia used its cameras to film public space disproportionately, including the terrace tables in front of a restaurant, and had put up no signs. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) imposed 3,000 EUR and ordered the cameras to be removed or realigned within 15 working days; the request for reconsideration was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. c, Art. 13 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Food and agriculture

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 31 Jul 2025 · Direct link